---
id: CVE-2026-87070
title: >-
  The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a
  request came from a trusted proxy before preferring client-supplied forwarding
  headers over the connecting address, and it uses that value both to enforce
  its p…
summary: >-
  The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a
  request came from a trusted proxy before preferring client-supplied forwarding
  headers over the connecting address, and it uses that value both to enforce
  its p…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-348
product: Forminator Forms
affected:
  - forminator_forms < 1.57.2.1
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:13:31.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87070'
references:
  - url: 'https://wpscan.com/vulnerability/3206e88e-5d29-4897-863e-101dc9b33ec5/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-23T10:35:03.336464Z'
ingestedAt: '2026-09-23T10:21:54.382Z'
epss: 0.00121
epssPercentile: 0.01694
---

## Overview

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.